Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: high
Valid

The `ScoreBoard::isEligibleForReward` function doesnt implement the requirement for players been eligible to get reward correctly, this would short change some players in the protocol that has made atleast one prediction.

Summary

The ScoreBoard::isEligibleForReward function doesnt implement the requirement for players been eligible to get reward correctly, this would short change some players in the protocol that has made atleast one prediction. The condition to be eligible for reward is that the player MUST atlease predict a game and have a positive score point. In the ScoreBoard::isEligibleForReward function this condition is not applied. Players that have made atleast one prediction are not eligible for reward which is NOT in line with the protocol's documentation. Players that have made atleast one prediction are eligible for reward.

Vulnerability Details

function isEligibleForReward(address player) public view returns (bool) {
return
results[NUM_MATCHES - 1] != Result.Pending &&
@> playersPredictions[player].predictionsCount > 1;
}
```diff
function isEligibleForReward(address player) public view returns (bool) {
return
- results[NUM_MATCHES - 1] != Result.Pending &&
+ results[NUM_MATCHES] != Result.Pending &&
- playersPredictions[player].predictionsCount > 1;
+ playersPredictions[player].predictionsCount >= 1;
}

playersPredictions[player].predictionsCount > 1 This code line makes it impossible for players that have made atleast one prediction NOT to be eligible for reward.

Impact

The ScoreBoard::isEligibleForReward function not been implemented in the protocol shortchanges the players that make atleast one prediction, this denies players that have made atleast one prediction of their rewards

Tools Used

Manuel Review

Recommendations

The `ScoreBoard::isEligibleForReward` function should be implemented according to documentation of the protocol, players that have predicted atleast one game should be eligible for reward.

function isEligibleForReward(address player) public view returns (bool) {
return
results[NUM_MATCHES - 1] != Result.Pending &&
@> playersPredictions[player].predictionsCount >= 1;
}
Updates

Lead Judging Commences

NightHawK Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

The eligibility criteria is wrong

Players with only one prediction cannot withdraw.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.